feat: bind galleries to the embedder that built them

GR-004 — a gallery built with one embedding model is meaningless with another.
Cosine similarities across models are garbage but look entirely plausible, so
this fails silently and expensively; every measurement taken against a
mismatched pair would have been quietly wrong.

The stamp is the model basename plus a SHA-256 of its bytes, with embed_dim as
a cheap extra guard. The hash decides and the name explains, because neither
works alone: a name is a promise rather than a fact — models get re-exported in
place under an unchanged filename, which is exactly the case where the weights
differ and nothing else does — while a bare hash mismatch tells an operator
nothing actionable.

Mismatch is fatal in every mode with no bypass. Unstamped only warns, because
unstamped is unknown rather than known-bad, and an error firing on every legacy
gallery trains people to reach for the bypass reflexively. scripts/stamp_gallery.py
binds an existing gallery in place with no re-embedding, so the warning is a
migration step rather than a permanent state; --require-gallery-stamp promotes
it to an error once a site has migrated.

Two gaps found that would have defeated the requirement outright:

- Embedding dumps carried no stamp, so a replay — which has no live embedder —
  had nothing to check the gallery against. Dumps now carry embedder_model and
  embedder_sha256 as root attributes. Additive; schema_version stays 1. This is
  the same gap the dump audit identified independently.
- --merge produced one file holding two embedding spaces, which no later check
  can untangle. Merge paths now verify before writing.

The stamp also survives identity_matcher's calibration write-back, which would
otherwise have stripped it on the first analysis run — the check would have
worked exactly once.

Conflicts resolved additively: both branches appended a source to sae_gallery
and to the test target, and both edited the GR-004 register row.

Merged suite: 64 cases, 3199 assertions, passing on CPU with no GPU.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

TRACES: GR-004, VR-001 | SR-001

This commit is contained in:

dtourolle

2026-07-30 19:04:07 +02:00

co-authored by

Claude Opus 5

parent 662a469870 7db40f430d

commit 908d166173

30 changed files with 1391 additions and 40 deletions

									
										CMakeLists.txt
									
		+1
		
												View File
												
				@@ -258,6 +258,7 @@ add_library(sae_gallery STATIC

				    src/gallery/gallery_store.cpp

				    src/gallery/gallery_builder.cpp

				    src/audio_signature.cpp        # IR-004 — content-derived audio signature

				    src/gallery/embedder_stamp.cpp # GR-004 — gallery/embedder binding

				)

				set_target_properties(sae_gallery PROPERTIES POSITION_INDEPENDENT_CODE ON)

				target_include_directories(sae_gallery PUBLIC src ${HDF5_INCLUDE_DIRS})